package com.zzhardy.interceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.zzhardy.annotation.security.RemoteAccess;
import com.zzhardy.utils.security.JwtUtil;
import io.jsonwebtoken.Claims;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.resource.DefaultServletHttpRequestHandler;

/**
 * @Author：Hardy
 * @Date：2019/10/2
 * @Function:
 */
@Component
public class PermissionInterceptor implements HandlerInterceptor {

    @Autowired
    private JwtUtil jwtUtil;
    private boolean isRemoteAccess(String method, Object handler) {
        if ((handler instanceof DefaultServletHttpRequestHandler)) {
            return true;
        }
        if (!(handler instanceof HandlerMethod)) {
            return false;
        }
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        if (handlerMethod.getMethod().getAnnotation(RemoteAccess.class) != null) {
            return true;
        }
        RemoteAccess passAuth = handlerMethod.getBeanType().getAnnotation(RemoteAccess.class);
        if (passAuth != null) {
            if (passAuth.value().length == 0) {
                //没有参数,所有类型方法通过
                return true;
            }
            for (RemoteAccess.Method m : passAuth.value()) {
                //有参数，和参数匹配的方法通过
                if (m.toString().equals(method)) {
                    return true;
                }
            }
        }
        return false;
        //return true;
    }
    
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        if (isRemoteAccess(request.getMethod(), handler)) {
            System.out.println("免登录");
            // 使用注解后，可直接免登录进行跳转
            return true;
        } else {
            System.out.println("须token");
            //无论如何都放行。具体能不能操作还是在具体的操作中去判断。
            // 栏截器只是负责把头请求头中包含token的令牌进行一个解析验证。
            String header = request.getHeader("Authorization");
            if (header != null && !"" .equals(header)) {
                if (header.startsWith("Bearer ")) {
                    //得到token
                    String token = header.substring(7);
                    try {
                        Claims claims = jwtUtil.parseJWT(token);
                        String roles = (String) claims.get("roles");
                        if(roles != null && roles. equals("admin")) {
                            request.setAttribute("claims_admin", token);
                        }
                        if(roles!=null&& roles. equals("user")){
                            request.setAttribute("claims_user", token);
                        }
                    } catch (Exception e) {
                        throw new RuntimeException("令牌有误！");
                    }
                }
            }
        }
        return true;
    }
}
